Bug 1207099 (CVE-2015-0899)

Summary:	CVE-2015-0899 Apache Struts 1: input validation bypass in MultiPageValidator
Product:	[Other] Security Response	Reporter:	Martin Prpič <mprpic>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aileenc, asantos, bkearney, cperry, dbhole, dknox, ggainey, gvarsami, jclere, jcoleman, jdobes, jdoyle, jshepherd, kconner, ldimaggi, lgao, meissner, mmraka, myarboro, nwallace, pavelp, puntogil, rhq-maint, rwagner, soa-p-jira, spinder, taw, tcunning, theute, thomas, tjay, tkirby, tlestach, twalsh, weli, yoguma
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Apache Struts 1.2.9 SP2	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-08-25 06:31:13 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1256620, 1256621
Bug Blocks:	1207110

Description Martin Prpič 2015-03-30 08:52:13 UTC

The following flaw was found in Apache Struts 1:

The Validator in Apache Struts 1.1 and later contains a function to efficiently define rules for input validation across multiple pages during screen transitions. This function contains a vulnerability where input validation may be bypassed. When the Apache Struts 1 Validator is used, the web application may be vulnerable even when this function is not used explicitly.

Upstream advisory:

http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000042.html
https://jvn.jp/en/jp/JVN86448949/index.html

Upstream patches:

http://en.sourceforge.jp/projects/terasoluna/wiki/StrutsPatch2-EN

Comment 4 Jason Shepherd 2015-07-06 02:01:17 UTC

While jbews-1 is affected by this issue, it's end of life was reached in June 2012. https://access.redhat.com/support/policy/updates/jboss_notes

Comment 6 Jason Shepherd 2015-07-07 01:18:54 UTC

Planning to remove struts from Fuse/FSW in next release:

  https://issues.jboss.org/browse/ENTESB-3567

Comment 7 Jason Shepherd 2015-08-24 06:18:59 UTC

Satellite 5.x is unaffected by this issue because it doesn't use ValidatorForm. It uses DynaActionForm instead, and validates in the Action classes.

Comment 8 Jason Shepherd 2015-08-25 06:30:44 UTC

We won't fix this issue in JBoss Operation Network because it doesn't use multipage forms. Also, all forms are only accessible from authenticated sections of JON.

We won't fix this issue for EPEL and Fedora as they are unsupported, and we're unlikely to consume these packages in supported products in future.

Comment 9 Jason Shepherd 2015-08-25 06:52:39 UTC

Created struts tracking bugs for this issue:

Affects: fedora-all [bug 1256620]
Affects: epel-7 [bug 1256621]